US8064597B2 - Method and system for mobile device credentialing - Google Patents

Abstract

Methods and systems taught herein allow mobile device manufacturers to preconfigure mobile devices for subscription with any network operator having access to a centralized device directory server. The directory server stores device records, each including a preliminary subscription identity. Manufacturers individually provision new mobile devices with these preliminary subscription identities, and network operators preliminarily register subscribers by submitting requests to the directory server that cause it to link individual device records with the appropriate credential server addresses. Mobile devices gain temporary network access by submitting their preliminary subscription identities, which get passed along to the directory server for verification. In turn, the directory server generates authentication vectors giving the mobile devices temporary network access, and returns the appropriate credential server addresses. The mobile devices use the address information to submit secure requests for permanent subscription credentials, and the involved credential servers securely return permanent subscription credentials responsive to valid requests.

Description

RELATED APPLICATIONS

This application claims priority under 35 U.S.C. §119(e) from the U.S. Provisional Patent Application Ser. No. 60/913,090, which was filed on 20 Apr. 2007 and entitled “OTA Soft SIM Credential Provisioning.”

BACKGROUND

1. Technical Field

The present invention generally relates to provisioning mobile devices, and particularly relates to facilitating over-the-air activation of mobile devices through the use of preliminary subscription identity information maintained in a centralized device directory that is accessible by one or more network operators.

2. Background

Efficient equipment manufacture, distribution, and activation are key enablers for effectively exploiting the range of business opportunities provided by the continuing revolution in wireless communications. The existing approaches to “provisioning” user equipment with the necessary subscription credentials represent one impediment to more efficient operations.

For example, one conventional approach relies on selling or otherwise distributing user equipment with installed Subscriber Identity Modules, SIMs. Each SIM comprises a tamper-resistant circuit module, commonly embodied in a small, card-like form factor, where the circuit module stores credential information for a specific network operator. In other words, the user equipment is tied to a particular network operator by virtue of the preprogrammed SIM, and the subscriber calls or otherwise contacts the network operator to provide billing information, etc. In response, the network operator marks that SIM as active in one or more subscriber databases, thereby making the user equipment operational.

Other approaches to automating the provisioning process, at least partially, have been proposed. Examples include U.S. Publication 2005/0079863 to Macaluso, which discloses a form of over-the-air provisioning (commonly noted as “OTA” provisioning in the relevant literature); U.S. Publication 2007/0099599 to Smith, which discusses dynamic provisioning of wireless services and initial provisioning via access to an internet database; U.S. Pat. No. 6,980,660 to Hind, which discloses methods for initializing wireless communication devices using an enterprise database; and U.S. Pat. No. 6,490,445 to Holmes, which discloses the use of temporary access information in wireless equipment, to allow a form of restricted network access for over-the-air provisioning.

As a general proposition, however, it seems that the complexity of the overall problem framework has prevented the past approaches from providing an overall system and method that simplifies manufacturing, sales, and, ultimately, registration of mobile devices with regard to secure over-the-air provisioning.

SUMMARY

Methods and systems taught herein allow mobile device manufacturers to pre-configure mobile devices for subscription with any network operator having access to a centralized device directory server. In at least one embodiment, mobile devices are provisioned with temporary device identifiers, which are also held in a centralized device directory server that is accessible to any number of network operators. Advantageously, a mobile station can be granted temporary access through any participating network, and that access thus is used to obtain permanent subscription credentials, via cooperation with a credential server associated with the network operator that will issue the permanent subscription credentials.

Accordingly, a method of facilitating over-the-air mobile communication device activation comprises, at a centralized device directory server, storing a device record that comprises preliminary subscription credential information for a mobile device, and sending at least part of the preliminary subscription credential information securely to an initial provisioning party, for use in initially provisioning the mobile device. The initial provisioning party may be, for example, a mobile device manufacturer. The method continues with receiving a device identifier for the mobile device from a credential server of a given network operator associated with an intended end-user of the mobile device, and correspondingly linking network address information of the credential server to the device record.

The method continues with receiving a validation request from an authentication server, responsive to the mobile device attempting to access a wireless communication network using the preliminary subscription credential information. In response to the validation request, the directory server sends an authentication vector based on a secret key included in the preliminary subscription credential information to the authentication server, if the preliminary subscription credential information for the mobile device is valid. The method also includes the directory server subsequently receiving a credential server address request from the mobile device, and sending network address information for the credential server to the mobile device, as linked in the device record stored for the mobile device.

In another embodiment, a system for facilitating over-the-air mobile communication device activation includes a centralized device directory server. The directory server in this embodiment comprises one or more processing circuits configured to store a device record that comprises preliminary subscription credential information for a mobile device, and to send at least part of the preliminary subscription credential information securely to an initial provisioning party, for use in initially provisioning the mobile device. The directory server is further configured to receive a device identifier for the mobile device from a credential server of a given network operator associated with an intended end-user of the mobile device, and correspondingly link network address information of the credential server to the corresponding device record.

Continuing, the directory server is configured to receive a validation request from an authentication server, responsive to the mobile device attempting to access a wireless communication network using the preliminary subscription credential information, and to send an authentication vector based on a secret key included in the preliminary subscription credential information to the authentication server, if the preliminary subscription credential information for the mobile device is valid. Still further, the directory server is configured to receive a credential server address request from the mobile device, subsequent to the mobile device gaining temporary access to the wireless communication network via the authentication vector, and to correspondingly send network address information for the credential server to the mobile device, as linked in the device record stored for the mobile device.

In one or more of the above embodiments, the preliminary subscription credential information, also referred to as preliminary subscription identities, comprise pairings of secret keys and Preliminary International Mobile Subscriber Identities, abbreviated as PIMSIs. Thus, the device directory stores, for example, a batch of PIMSI and secret key pairs, and device manufacturers provision individual, mobile devices with individual PIMSI and secret key pairs.

Of course, the present invention is not limited to the above features and advantages. Indeed, those skilled in the art will recognize additional features and advantages upon reading the following detailed description, and upon viewing the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of one embodiment of at least part of a system for facilitating over-the-air provisioning of mobile devices, including a centralized device directory server that provides preliminary subscription credential information to initial provisioning servers associated with, for example, device manufacturers.

FIG. 2 is a block diagram of one embodiment of a “device record” data element or structure, which includes a temporary device identifier and a secret key.

FIG. 3 is a block diagram of one embodiment of a mobile device.

FIG. 4 is a logic flow diagram of one embodiment of processing logic that may be implemented at a centralized device directory server, for generating and distributing preliminary subscription identities for use in initially provisioning mobile devices.

FIG. 5 is a logic flow diagram of one embodiment of processing logic that may be implemented at an initial provisioning server, for use in initially provisioning mobile devices based on information received or otherwise associated with preliminary subscription credential information stored in a centralized device directory server.

FIG. 6 is a block diagram of one embodiment of one or more credential servers that are communicatively coupled to a centralized device directory server, and are associated with one or more network operators.

FIG. 7 is a logic flow diagram of processing logic that may be implemented at a credential server, for causing a centralized device directory server to associate particular preliminary subscription credential information held by the centralized device directory server for particular mobile devices to the credential server.

FIG. 8 is a block diagram illustrating one embodiment of an overall system for facilitating over-the-air provisioning of a mobile device, including a centralized device directory server.

DETAILED DESCRIPTION

FIG. 1 illustrates one embodiment of a centralized device directory server10 (“directory server10”), as contemplated herein for facilitating over-the-air activation of mobile devices. The term “mobile device” should be construed broadly herein. By way of non-limiting example, the term encompasses cellular radiotelephones and other types of wireless mobile stations, and encompasses network access cards, and other wireless communication modules. Similarly, the term “activation” should be construed broadly, and the term at least refers to a method whereby a subscriber conveniently and securely obtains permanent (long-term) subscription credentials from the subscriber's associated network operator via an over-the-air provisioning process, even where the subscriber gains temporary network access through another network operator.

Better appreciating the flexibility and convenience of the activation system and method contemplated herein begins with a more detailed understanding of thedirectory server10, in accordance with the example details illustrated in the figure. It includes or is associated with adata store12, and includes one ormore processing circuits14. Theprocessing circuits14 includecommunication interfaces16 and preliminary subscription processing circuits18 (“subscription processing circuits18”). Theprocessing circuits14 comprise hardware, software, or any combination thereof. For example, theprocessing circuits14 may include one or more microprocessor-based circuits, which are configured to carry out the functions described herein by way of executing stored program instructions. Those instructions may be embodied as a computer program product retained, for example, in a computer-readable medium of thedata store12, or may be held in other memory/storage devices included in or associated with thedirectory server10.

Other information stored at thedirectory server10 includes abatch20 ofdevice records22. Device records22-1 through22-N are illustrated, as an example. As shown inFIG. 2, in at least one embodiment, eachdevice record22 comprises preliminary subscription information for a mobile device. In one embodiment, eachdevice record22 includes atemporary device identifier24 and asecret key26. Also, as will be explained later, eachdevice record22 is linked to (e.g., includes or points to) credential servernetwork address information28. (Further, while not explicitly illustrated in the drawing, thedirectory server10 may store a Public Device Identifier (PDI) in eachdevice record22. In one example, the PDI is obtained using a one-way “hash” function on thetemporary device identifier24.)

According to this basic setup, eachdevice record22 represents temporary subscription credentials for one mobile device. Thedirectory server10 is configured in one or more embodiments to generatebatches20 ofdevice records22, which can then be distributed to any number of parties involved in initially provisioning mobile devices. Typically, device records22 are distributed to one or more mobile device manufacturers. In at least one embodiment herein,different batches20 ofdevice records22 are generated for different manufacturers. For example, assuming that thetemporary device identifier24 is generated as a number, e.g., a Preliminary International Mobile Subscriber Identity (PIMSI), different ranges of numbers may be used for different device manufacturers. Doing so permits network elements involved in later over-the-air activation of a mobile device to determine the device's manufacturer from the range value of thetemporary device identifier24 reported by the mobile device.

Now, referring back toFIG. 1, one sees that thedirectory server10 generates one ormore batches20 ofdevice records22, and distributes the device records22 to an initial provisioning server30 (or other computer system) at each of one or more mobile device manufacturers. Particularly,FIG. 1 illustrates initial provisioning servers30-1 through30-R, associated with differentmobile device manufacturers1 through R. Eachprovisioning server30 receives some number ofdevice records22 from thedevice directory10, and loads all or part of anindividual device record22 into a particular one of themobile devices32 being initially provisioned by it. This loading may be integrated into the manufacturing process.

Preferably, as shown inFIG. 3, eachmobile device32 includes system circuits40 (processsors, user-interface circuits, etc.), communication circuits42 (cellular, WLAN, WiFi, etc.), and a trustedmodule44, such as configured according to ARM® TrustZone®, Mobile Trusted Module (MTM), or Trusted Platform Module (TPM) implementations. In one or more embodiments, the trustedmodule44 includes, for example, asecure processor46,secure memory48, and acryptographic engine50. Other secure processing environments can be used, and the secure architecture details that are illustrated should not be construed as limiting the teachings presented herein.

In any case, aninitial provisioning server30 thus loads into a givenmobile device32, all or part of adevice record22, where thatdevice record22 is also held by thedirectory server10. In this manner, a subscriber's later attempt to activate themobile device32 may be predicated on verifying the device record information as stored in themobile device32 against the corresponding device record information as stored in thedirectory server10.

FIGS. 4 and 5 summarize the above process, wherein, inFIG. 4, thedirectory server10 generates preliminary subscription identities (Block100) (e.g., generates device records22 comprising pairs ofPIMSIs24 and secret keys26). Thedirectory server10 then distributes the preliminary subscription identities to mobile device manufacturers (Block102). That operation may be a “push” from thedirectory server10, or a “pull” from thedirectory server10, with all such transfers subject to appropriate security verification, etc. Communications between thedirectory server10 and theinitial provisioning servers30 may be Internet-based, or based on some other network connectivity.

Regardless, thedirectory server10 generates individual device records22, each including atemporary device identifier24 and a secret key26 (denoted as “K_p”) as a pair. As noted, thetemporary identifier24 may comprise a PIMSI. In at least one embodiment, the PIMSI is equal to the UMTS/GSM IMSI number, such that standard mobile terminal authentication procedures can be used for the PIMSI. Thedirectory server10 thus sends PIMSI/K_ppairs toinitial provisioning servers30 as the device records22. For example,multiple device records22 are sent as PIMSI₁/K_p1, PIMSI₂/K_p2, . . . , and so on. Thedirectory server10 also may send its network address information, or theinitial provisioning server30 may be configured with that information.

FIG. 5 illustrates that theinitial provisioning server30 of a given mobile device manufacturer supports provisioning individualmobile devices32 using the preliminary subscription information received from the directory server10 (Block104). Theinitial provisioning server30 also may load into eachmobile device32 network address information for thedirectory server10, along with a listing of network operators that support use of the preliminary subscription information (Block106). (This listing thus allows themobile device32 later to select an appropriate network operator, assuming multiple network operators provide coverage in the mobile's location, for carrying out over-the-air provisioning of themobile device32 with permanent subscription credentials.)

In more detail, theinitial provisioning server30 may be configured to generate a public/private key pair, denoted as PuK/PrK, using secure processing. In such embodiments, the preliminary subscription information for device record22-xthus would include PuK_x, PrK_x, K_px, and the temporary device identifier24 (e.g., PIMSI_x). Theinitial provisioning processor30 loads this information in the trustedmodule44 of themobile device32. Theinitial provisioning server30 also loads, as mentioned, a listing of network operators that support use of the preliminary subscription information, e.g., a listing of network operators that will accept the use of PIMSIs for gaining temporary network access. The initial provisioning server also may load network address information for thedirectory server10.

More generally, it should be understood that, in one or more embodiments, the trustedmodule44 of themobile device32 is provisioned with the temporary device identifier24 (e.g., PIMSI_x) the secret key K_px, and the public/private key pair PuK_x/ PrK_x(for later use in over-the-air activation of the mobile device32), and that all such values may be provided by theinitial provisioning server30, or that one or more of them may be self-generated by themobile device32. For example, in at least one embodiment, themobile device32 is configured to generate the public/private key pair PuK_x/PrK_x. The provisioning information also generally includes a listing of network operators that support temporary wireless communication network access via use of thetemporary device identifier24, and may optionally include network address information for thedirectory server10.

At some later time, a givenmobile device32 is sold to or otherwise targeted for association with a subscriber of a given network operator. As an example illustration,FIG. 6 depicts three different credential servers60-1,60-2, and60-3, which may represent credentialing elements from three different network operators. The illustratedcredential servers60 are communicatively coupled to thedirectory server10, and are thus able to indicate to thedirectory server10 which ones of the device records22 held by thedirectory server10 are to be associated with or otherwise linked to which ones of thecredential servers60.

FIG. 7 illustrates an example embodiment, wherein the credential server60-xof a given network operator communicates with thedirectory server10, e.g., via an Internet or other network connection. Particularly, the credential server60-xobtains or is otherwise provided with subscriber data (Block110). For example, a sales or other computer system provides the credential server60-xwith subscriber details for particular PDIs, where the PDIs correspond toindividual device records22 in thedirectory server10. The credential server60-xthus may receive subscriber records, where each subscriber record includes details for a particular subscriber, along with a PDI and the address of thedirectory server10 that holds thedevice record22 corresponding to that PDI.

Thus, a PDI corresponding to a particulartemporary device identifier24 is associated with or otherwise linked to data for a particular subscriber at the credential server60-x. This subscription data, which function as subscription credentials, also may include secret subscription values, like a UMTS “master key.” In any case, processing continues with the credential server60-xsending PDI information to the directory server10 (Block112). Receipt of that PDI information causes thedirectory server10 to associate or otherwise link the device records22 corresponding to the received PDI information with the credential server60-x.

Thedirectory server10 therefore is configured to receive a PDI from the credential server60-x, and, in response, to link thedevice record22 corresponding to the PDI with the credential server60-x. As one example, the PDI is a one-way hash of a PIMSI, and thedevice directory10 processes the PDI to obtain the corresponding PIMSI, and then uses the recovered PIMSI to index into one ormore batches20 of storeddevice records22, to identify thedevice record22 that matches the recovered PIMSI.

Once thecorrect device record22 is identified, thedirectory server10 links it to the credential server60-x, e.g., it stores network address information for the credential server60-x in the identifieddevice record22, or causes thatdevice record22 to “point” to the credential server60-x. For each such linked PDI-device record22, the credential server60-x receives a second secret key to the credential server60-x from the directory server10 (Block114). That second secret key is denoted as K_tto indicate its temporary status. Thedirectory server10 derives from the secret key K_pof theinvolved device record22. For example, K_t=F(K_p), where “F” denotes a suitable cryptographically strong one-way function. The credential server60-x stores this temporary key K_twith the rest of the subscriber data associated with the given PDI.

In the context of the above preliminary subscriber registration, given mobile device manufacturers may send PDIs and corresponding device directory address information directly to network operators. For example, aninitial provisioning server30 or other manufacturer's computer system may be communicatively coupled to thecredential servers60 of one or more network operators. Such communications allow mobile device manufacturers to link particularmobile devices32 to particular network operators prior to any retail sales.

Additionally or alternatively, individualmobile devices32 are shipped to their respective purchasers. The PDIs and device directory associations for thosemobile devices32 are provided to those purchasers, such as in written or electronic form accompanying the mobile devices themselves. Thus, once an end-user buys or otherwise obtains a particularmobile device32, that end-user registers the PDI and device directory information of thatmobile device32 with thecredential server60 belonging to a network operator of choice.

FIG. 8 illustrates one embodiment of this end-user registration as part of an overall methodology contemplated herein. As illustrated atStep1, adirectory server10 provides a PIMSI/secret key pair (PIMSI_x/K_px) to aninitial provisioning server30. The provided data matches adevice record22 stored within thedirectory server10.

AtStep2, theinitial provisioning server30 generates a public/private key pair, PuK_x/PrK_x, and initially provisions an individual mobile device32-xby loading it with PuK_x/PrK_x, K_px, PIMSI_x, network address information for thedirectory server10, and a listing of participating network operators. Alternatively, the mobile device32-xself-generates PuK_x/PrK_x, rather than those values being generated by theinitial provisioning server30.

AtStep3, an end-user or other subscriber associated with the mobile device32-xsubmits subscriber registration data to thecredential server60. As an example, thecredential server60 receives subscriber identity and billing information, along with PDI_x, and network address or other identifying information for adirectory server10.

AtStep4, thecredential server60 submits PDI_xto thedirectory server10, thereby causing thedirectory server10 to process PDI_xand identify the corresponding device record22-x, and link that device record22-xto the submittingcredential server60.

AtStep5, thedirectory server10 returns a temporary secret key, K_tx, to thecredential server60.

AtStep6, the mobile device32-xcontacts awireless communication network70 and provides it with itstemporary device identifier24, e.g., with PIMSI_x. More particularly, the mobile device32-xmay be configured to attempt to register with thewireless communication network70 using standard GSM/UMTS registration procedures in which it provides its PIMSI_xto thenetwork70 as part of registration. Further, the mobile device32-xmay be configured to determine that thenetwork70 is appropriate for such registration attempts, based on its stored listing of network operators that support use oftemporary device identifiers24 as a basis for gaining long-term subscription credentials via over-the-air provisioning.

Also, as part ofStep6, thenetwork70 passes the PIMSI_xobtained from the mobile device32-xto anauthentication server72. Theauthentication server72 may be, for example, a Visitor Location Register (VLR) and/or a Home Location Register (HLR) associated with thenetwork70 or with a home network of a network operator associated with themobile device32.

AtStep7, theauthentication server72 recognizes the PIMSI_xas a temporary identifier, and passes the PIMSI_xto theappropriate directory server10. In one or more embodiments, theauthentication server72 is configured to determine the network address information for thedirectory server10 from the PIMSI_xreceived from the mobile device32-x.

AtStep8, thedirectory server10 finds the correct data record22-xcorresponding to the PIMSI_xas received from theauthentication server72. As part of this processing, thedirectory server10 may determine the validity of the PIMSI_xby checking whether the PIMSI_xis blocked, expired, or has otherwise been used more than an allowed number of times. Thus, if the PIMSI_xexists within the batch(es)20 ofdevice records22 stored at thedirectory server10 and is valid, thedirectory server10 calculates a temporary authentication vector for the mobile device32-xand returns the authentication vector to theauthentication server72.

In one or more embodiments, thedevice directory10 is configured to derive the authentication vector using the secret key K_pxstored in the device record22-xfor the mobile device32-x. In this regard, thedevice directory10 can be configured to generate the authentication vector using standardized 3rd Generation Partnership Project (3GPP) procedures, such as the MILENAGE algorithm. Doing so increases interoperability. Regardless,Step8 is shown continuing across theauthentication vector72, indicating that the authentication vector is passed back to thenetwork70.

AtStep9, thenetwork70 uses the authentication vector to grant temporary access, e.g., temporary packet data access, to the mobile device32-x. As one example, the authentication vector is valid for a limited amount of time, e.g., one minute, and/or is valid for a very limited amount of data transfer.

AtStep10, the mobile device32-xuses its temporary access to communicate with thedirectory server10. In this regard, it was noted that network address information for thedirectory server10 can be included as part of the mobile device's initial provisioning information. Thus, the mobile device32-xcan use that stored information to contact theappropriate directory server10 after gaining temporary access. While the diagram appears to show communication directly between the mobile device32-xand thedirectory server10, those skilled in the art will appreciate that the link may be indirect, and, in general, includes an over-the-air connection being supported by thenetwork70 according to the temporary authentication vector. With its communicative link to thedirectory server10, the mobile device32-xrequests that thedirectory server10 provide it with the credential server address information linked at thedirectory server10 to its PIMSI_x.

AtStep11, thedirectory server10 returns the credential server address information to the mobile device32-x.

AtStep12, the mobile device32-xgenerates a new temporary key, K_tx. In at least one embodiment, the mobile device32-xderives K_txfrom its secret key K_px.

AtStep13, the mobile device32-xsends a credential request to thecredential server60, as identified by the credential server address information returned to the mobile device32-xfrom thedevice directory10. (Again, such communications generally are indirect, with at least one part of the link supported by an over-the-air connection made through thenetwork70.) In one embodiment, this request is protected using the temporary key K_tx, and, possibly, a Message Authentication Code (MAC). In another embodiment, the connection is protected by the temporary key K_txand a transport security protocol, such as TLS. Regardless, in at least one embodiment, the request includes the mobile device's public key PuK_x, and the PDI_xcorresponding to the mobile devices's PIMSI_x.

AtStep14, thecredential server60 creates permanent (long-term) subscription credentials for themobile device32. For example, if may generate a Soft Subscriber Identity Module (SSIM) or other form of software-based authorization information. Such data may include both SIM credentials and SSIM parameters. SSIM parameters may include SIM algorithms having specific applicability to the network operator associated with thecredential server60.

AtStep15, thecredential server60 encrypts the permanent subscription credentials using the public key of themobile device32, PuK_x, and sends them to themobile device32. In another embodiment, the credential server uses the temporary key, K_tx, to encrypt the permanent subscription credentials. Doing so, however, raises a possible security implication because K_txis derived from the secret key K_px, which is also held at thedirectory server10.

AtStep16, the mobile device receives the encrypted permanent subscription credentials, decrypts them, and installs them, e.g., within its trustedmodule44. This process may include any needed SIM or other software updating. Regardless, themobile device32 is now provisioned with permanent subscription credentials, giving themobile device32 access to home and visitor wireless communication networks within any limits established by those credentials.

A basic but non-limiting idea that is realized by the above arrangement is that mobile device manufacturers are permitted to initially provisionmobile devices32 in such a way that they can be later activated (permanently provisioned) using over-the-air activation though any number of participating network operators. This arrangement thus allows amobile device32 to gain temporary wireless communication network access using preliminary subscription identity information, and then use that access to obtain the address of and connection to a credential server that will provide it with permanent subscription information. Put simply, a potentially large number of different network operators may agree to participate in the described arrangement, and communicatively link their respective wireless communication networks to the directory server10 (or to any one in a number of different directory servers10).

Thus, a system and method for facilitating over-the-air mobile communication device activation are presented herein. However, it should be understood that the foregoing description and the accompanying drawings represent non-limiting examples of the methods, systems, and individual apparatuses taught herein. As such, the present invention is not limited by the foregoing description and accompanying drawings. Instead, the present invention is limited only by the following claims and their legal equivalents.

Claims (18)

1. A method of facilitating over-the-air mobile communication device activation comprising, at a centralized device directory server:

storing a device record that comprises preliminary subscription credential information for a mobile device;

sending at least part of the preliminary subscription credential information securely to an initial provisioning party, for use in initially provisioning the mobile device;

receiving a device identifier for the mobile device from a credential server of a given network operator associated with an intended end-user of the mobile device, and correspondingly linking network address information of the credential server to the device record;

receiving a validation request from an authentication server, responsive to the mobile device attempting to access a wireless communication network using the preliminary subscription credential information;

sending an authentication vector to the authentication server that is based on a secret key included in the preliminary subscription credential information, if the preliminary subscription credential information for the mobile device is valid;

receiving a credential server address request from the mobile device, subsequent to the mobile device gaining temporary access to the wireless communication network via the authentication vector; and

sending network address information for the credential server to the mobile device, as linked in the device record stored for the mobile device.

2. The method ofclaim 1, wherein storing the device record comprises storing a Preliminary International Mobile Subscriber Identity, PIMSI, and the secret key for the mobile device.

3. The method ofclaim 2, wherein receiving the device identifier for the mobile device from the credential server of the given network operator associated with the intended end-user of the mobile device comprises receiving a Public Device Identifier, PDI, that is derived from the Preliminary International Mobile Subscriber Identity, PIMSI, of the mobile device, and further comprising identifying the device record for the mobile device from the Public Device Identifier, PDI, and linking the device record to the network address information of the credential server.

4. The method ofclaim 2, further comprising initially provisioning a trusted module of the mobile device with the Preliminary International Mobile Subscriber Identity, PIMSI, the secret key, and a public/private key pair, and further provisioning the mobile device with network address information for the centralized device directory server and a listing of network operators that support temporary wireless communication network access via use of the Preliminary International Mobile Subscriber Identity, PIMSI.

5. The method ofclaim 4, further comprising gaining the temporary access to the wireless communication network by the mobile device based on the mobile device providing the Preliminary International Mobile Subscriber Identity, PIMSI, to the wireless communication network, and the wireless communication network forwarding the Preliminary International Mobile Subscriber Identity, PIMSI, to the authentication server for transfer to the centralized device directory server.

6. The method ofclaim 5, further comprising gaining access to the credential server of the given network operator by the mobile device, based on the mobile device receiving the network address information for the credential server from the centralized device directory server, and sending a credential request from the mobile device to the credential server, said credential request including the public key of the public/private key pair stored in the mobile device, and said credentialing request protected by a temporary key derived from the secret key stored in the mobile device.

7. The method ofclaim 6, further comprising, at the credential server, verifying the credentialing request from the mobile device, and generating a Soft Subscriber Identity Module, SSIM, and sending the SSIM to the mobile device in encrypted form using the public key of the mobile device, for use by the mobile device in installing permanent subscription credentials for the given network operator.

8. The method ofclaim 2, further comprising, at the centralized device directory server, deriving a second secret key from the secret key, and sending the second secret key for storage at the credential server in association with end-user subscriber data, for later use in protecting Soft Subscriber Identity Module, SSIM, information generated by the credential server and sent over-the-air to the mobile device.

9. A system for facilitating over-the-air mobile communication device activation including a centralized device directory server that comprises one or more processing circuits configured to:

store a device record that comprises preliminary subscription credential information for a mobile device;

send at least part of the preliminary subscription credential information securely to an initial provisioning party, for use in initially provisioning the mobile device;

receive a device identifier for the mobile device from a credential server of a given network operator associated with an intended end-user of the mobile device, and correspondingly link network address information of the credential server to the device record;

receive a validation request from an authentication server, responsive to the mobile device attempting to access a wireless communication network using the preliminary subscription credential information;

send an authentication vector to the authentication server that is based on a secret key included in the preliminary subscription credential information, if the preliminary subscription credential information for the mobile device is valid; and

receive a credential server address request from the mobile device, subsequent to the mobile device gaining temporary access to the wireless communication network via the authentication vector, and to correspondingly send network address information for the credential server to the mobile device, as linked in the device record stored for the mobile device.

10. The system ofclaim 9, wherein the centralized device directory server is configured to store, as the device record, a Preliminary International Mobile Subscriber Identity, PIMSI, and the secret key for the mobile device.

11. The system ofclaim 10, wherein the centralized device directory server includes a communication interface configured to communicate directly or indirectly with the credential server, and to receive, as the device identifier for the mobile device, a Public Device Identifier, PDI, that is derived from the Preliminary International Mobile Subscriber Identity, PIMSI, of the mobile device, and wherein the centralized device directory server is configured to identify the device record for the mobile device from the Public Device Identifier, PDI, and link the device record to the network address information of the credential server.

12. The system ofclaim 10, further comprising an initial provisioning server configured to provision a trusted module of the mobile device with the Preliminary International Mobile Subscriber Identity, PIMSI, and the secret key, and to further provision the mobile device with network address information for the centralized device directory server, and a listing of network operators that support temporary wireless communication network access via use of the Preliminary International Mobile Subscriber Identity, PIMSI.

13. The system ofclaim 12, wherein the initial provisioning server is further configured to provision the trusted module of the mobile device with a public/private key pair for later use in over-the-air activation of the mobile device.

14. The system of12, wherein the authentication server is communicatively coupled to the wireless communication network and is configured to receive the Preliminary International Mobile Subscriber Identity, PIMSI, and to correspondingly receive an authentication vector for the mobile station in response to transferring the Preliminary International Mobile Subscriber Identity, PIMSI, to the centralized device directory server for verification, and to return the authentication vector to the wireless communication network for granting temporary access to the mobile device.

15. The system ofclaim 14, wherein the centralized device directory server is configured to receive a credential server address request from the mobile device after the mobile device is granted temporary access based on the authentication vector, and to return the network address information of the credential server, as linked to the device record of the mobile device.

16. The system ofclaim 15, wherein the mobile device is configured to receive the network address information for the credential server from the centralized device directory, and correspondingly to send a credential request for permanent subscription credentials to the credential server, said credential request including the public key of the public/private key pair stored in the mobile device, and said credentialing request protected by a temporary key derived from the secret key of the mobile device.

17. The system ofclaim 16, wherein the credential server is configured to verify the credentialing request from the mobile device and correspondingly to generate a Soft Subscriber Identity Module, SSIM, and is further configured to send the SSIM to the mobile device in encrypted form as protected by the public key of the mobile device, for use by the mobile device in installing permanent subscription credentials for the given network operator.

18. The system ofclaim 9, wherein the centralized device directory server is configured to derive a second secret key from the secret key, and send the second secret key for storage at the credential server in association with end-user subscriber data, for later use in protecting Soft Subscriber Identity Module, SSIM, information generated by the credential server and sent over-the-air to the mobile device.

Images